Hacker News Reader

Comment by strict9 | Hacker News Reader

While I agree with his viewpoints, I just can't take a security professional (or CTO) seriously who uses Windows as their primary machine.

View on HN

So basically you don't take something like 3 of the top 5 vulnerability researchers in the world seriously.

Can you please explain why? Is there some evidence you have that shows that Windows is less secure than any other OS? Please take into account the huge market share which means that malware writers will spend a disproportionate amount of time developing for Microsoft systems. Also, people who run other Operating Systems tend to be more technically skilled than people using Windows.

This is not to excuse Microsoft, they could certainly do better. But so could Apple and Debian.

My remark was certainly flippant. It was a gut reaction to statements he's made about a Linux machine as the best bet (see his interview with VICE), but yet he still primarily uses Windows.

I think there's a lot to be said for those who practice what they preach rather than sticking with a lesser option out of convenience.

Perhaps he's more skilled at Windows than at Linux? In which case, if he were to switch to a platform that's unfamiliar, he would be more likely to make an error that would lead him to being vulnerable.

I'd suggest that by using a platform that he knows how to make secure rather than one he's unfamiliar with, he is acting in the best way to ensure the security of his device.

Listen to what I say, don't do as I do.

Also there are very good reasons for using windows - dogfooding your own security solutions, fact that a lot of threats are targeting windows machines and the fact that he is not a high profile target (or wasn't before the NSA stuff) so no one will waste undisclosed zero day on him.

Maybe they have done what is required to fully secure the box? (Short of removing whatever BD NSA might actually have in windows ;-) )

I really doubt the fact that NSA have direct backdoor in windows. A lot of countries will treat it as casus belli.

> I really doubt the fact that NSA have direct backdoor in windows. A lot of countries will treat it as casus belli.

Against the US? I doubt it. Countries sometimes fail to treat actual armed intrusions without local consent by the US as casus belli because of the imbalance in military power, and you want me to believe that there are "a lot" of countries that will treat a backdoor in Windows as an excuse for war?

I doubt that NSA has a Microsoft-complicit backdoor in Windows, but would be amazed to find out that they didn't have its functional equivalent. For any given mainstream OS, assume NSA can own it up at will.

I am absolutely sure they can enter almost anything not behind solid air gap.

Doesn't that contradict your previous post?

Not the way I read it. The previous post seems to be suggesting the NSA doesn't have some backdoor into Windows that Microsoft put there for them explicitly, while the followup suggests that even without such an explicit backdoor, one should assume the NSA can take control of just about any system with a network connection (which is probably not explicitly true, but is true enough that you should just assume it).

The second suggestion being they (the NSA) have a (likely lengthy) list of exploits found in common OSes (and/or firmware or CPU microcode) that they have never divulged and that they have discovered like any external security research would have (albeit one with a very large budget and a very strong incentive to find such control vectors).

Ah - yes that makes good sense.

I prefer to assume that both are true.

Reply on news.ycombinator.com